SQL Injection Risk in Product Table and List Builder for WooCommerce Lite by WordPress

CVE-2026-2232

What is CVE-2026-2232?

The Product Table and List Builder for WooCommerce Lite plugin for WordPress exhibits a time-based SQL injection vulnerability. This issue arises from inadequate sanitization of user-supplied parameters in the 'search' function, leading to insufficiently prepared SQL queries. Attackers, who do not require authentication, can exploit this flaw to inject and execute unauthorized SQL commands, potentially extracting sensitive data from the database. This vulnerability highlights the critical importance of proper input validation and prepared statements in securing web applications.

References